grub2/grub2-s390x-11-secureboot.patch

---
 grub-core/loader/emu/linux.c  |    4 ++--
 util/s390x/dracut-grub2.sh.in |   14 ++++++++++++--
 util/s390x/zipl2grub.conf.in  |    1 +
 util/s390x/zipl2grub.pl.in    |   31 ++++++++++++++++++++++---------
 4 files changed, 37 insertions(+), 13 deletions(-)

--- a/grub-core/loader/emu/linux.c
+++ b/grub-core/loader/emu/linux.c
@@ -38,7 +38,7 @@ grub_linux_boot (void)
 {
   grub_err_t rc = GRUB_ERR_NONE;
   char *initrd_param;
-  const char *kexec[] = { "kexec", "-l", kernel_path, boot_cmdline, NULL, NULL };
+  const char *kexec[] = { "kexec", "-la", kernel_path, boot_cmdline, NULL, NULL };
   const char *systemctl[] = { "systemctl", "kexec", NULL };
   int kexecute = grub_util_get_kexecute();
 
@@ -51,7 +51,7 @@ grub_linux_boot (void)
     //return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("initrd required!"));
   }
 
-  grub_printf("%serforming 'kexec -l %s %s %s'\n",
+  grub_printf("%serforming 'kexec -la %s %s %s'\n",
 	(kexecute) ? "P" : "Not p",
 	kernel_path, initrd_param, boot_cmdline);
 
--- a/util/s390x/dracut-grub2.sh.in
+++ b/util/s390x/dracut-grub2.sh.in
@@ -18,6 +18,9 @@ if getargbool 0 initgrub && [ ! -e /grub
    done < /proc/mounts
    echo $rofs
   }
+  checkcat() {
+    [ -r $1 ] && cat $1
+  }
   checkd() {
     [ -d $1 ] && echo true || echo false
   }
@@ -63,6 +66,7 @@ if getargbool 0 initgrub && [ ! -e /grub
     export grub2bootfs=$(checkboot)
     export grub2devfs=$(checkd /sysroot/dev/disk)
     export grub2snap=$(checksnap)
+    export grub2secure=$(checkcat /sys/firmware/ipl/secure)
     debug "" export -p
 
         _ctty="$(RD_DEBUG= getarg rd.ctty=)" && _ctty="/dev/${_ctty##*/}"
@@ -93,7 +97,7 @@ if getargbool 0 initgrub && [ ! -e /grub
     debug "Trying grub2-emu (ro=$grub2rofs, TERM=$TERM, ctty=$_ctty)..."
     setsid $CTTY -- chroot /sysroot $bindir/grub2-emu -X -X 0<>$_ctty 1>&0 2>&0
 
-    if [ -x /sysroot@libdir@/grub2/zipl-refresh ]; then
+    if [ "$grub2secure" != 1 ]&&[ -x /sysroot@libdir@/grub2/zipl-refresh ]; then
 	setsid $CTTY -- /sysroot@libdir@/grub2/zipl-refresh 0<>$_ctty 1>&0 2>&0
 	if [ $? != 0 ]; then
 	    warn "Not continuing"
@@ -103,12 +107,18 @@ if getargbool 0 initgrub && [ ! -e /grub
 	    sleep 3
 	    reboot
 	fi
-    else
+    elif [ "$grub2secure" != 1 ]; then
 	echo "
   Attention: 'grub2' failed to start the target kernel and 'zipl-refresh'
   is not available.  This should never happen.  Please contact support." >& $_ctty
 	warn "Not continuing"
 	emergency_shell -n grub2-emu-kexec
+    else
+	echo "
+  Attention: 'grub2' failed to start the target kernel and secure boot seems
+  active.  Automatic recovery not available.  Please contact support." >& $_ctty
+	warn "Not continuing"
+	emergency_shell -n grub2-emu-kexec
     fi
 
     $grub2snap || umount /sysroot/.snapshots
--- a/util/s390x/zipl2grub.conf.in
+++ b/util/s390x/zipl2grub.conf.in
@@ -45,6 +45,7 @@ defaultmenu = menu
     timeout = 60
     default = 1
     prompt = 0
+    secure = @SUSE_SECURE_BOOT@
     1 = grub2
     2 = skip-grub2
     3 = grub2-mem1G
--- a/util/s390x/zipl2grub.pl.in
+++ b/util/s390x/zipl2grub.pl.in
@@ -21,6 +21,7 @@ my $miss = 0;
 my $cfg = "";
 my %fsdev = ();
 my %fstype = ();
+my %SBL = (); # key/value of $sysconfbl
 
 my %C = (
   GRUB_CMDLINE_LINUX_DEFAULT => "quiet splash=silent",
@@ -251,6 +252,15 @@ if ( -r $default ) {
   }
   close( IN);
 }
+if ( -r $sysconfbl ) {
+  open( IN, "< $sysconfbl") ||  die;
+  while ( <IN> ) {
+    next if ( m{^\s*#} );
+    next unless ( m{^\s*([^=#\s]+)="(.*)"(?:\s*|\s+#.*)$} );
+    $SBL{$1} = $2;
+  }
+  close( IN);
+}
 if ( -r "/etc/fstab" ) {
   my $regex = qr{^(\S+)\s+(\S+)\s+(\S+)\s+\S+\s+\S+\s+\S+\s*(?:#.*)?$};
   open( IN, "< /etc/fstab") || die;
@@ -313,21 +323,21 @@ if ( ! exists( $C{GRUB_DEVICE}) ) {
   }
 }
 if ( $C{GRUB_CMDLINE_LINUX_DEFAULT} eq "quiet splash=silent" &&
-     -r $sysconfbl) {
-  open( IN, "< $sysconfbl") ||  die;
-  while ( <IN> ) {
-    next if ( m{^\s*#} );
-    if ( m{^DEFAULT_APPEND=".*"(?:\s*|\s+#.*)$} ) {
-      $C{GRUB_CMDLINE_LINUX_DEFAULT} = $1;
-    }
-  }
-  close( IN);
+     exists( $SBL{DEFAULT_APPEND}) ) {
+  $C{GRUB_CMDLINE_LINUX_DEFAULT} = $SBL{DEFAULT_APPEND};
 }
 
 if ( ! exists( $C{GRUB_DEVICE})) {
   Panic( 0, "$C: Default not ready and no fallback.  Please retry later!\n");
 }
 
+if ( !exists( $C{SUSE_SECURE_BOOT}) ) {
+  $C{SUSE_SECURE_BOOT} = "0";
+  if ( exists( $SBL{SECURE_BOOT}) && $SBL{SECURE_BOOT} =~ m{^(yes|true|1)$} ) {
+    $C{SUSE_SECURE_BOOT} = "1";
+  }
+}
+
 if ( ! exists( $C{GRUB_EMU_CONMODE}) && exists( $C{GRUB_CONMODE}) ) {
   # GRUB_CONMODE is used for 'grub2-emu' as well
   $C{GRUB_EMU_CONMODE} = $C{GRUB_CONMODE};
@@ -360,6 +370,9 @@ if ( $debug && $verbose > 2 ) {
   foreach ( sort( keys( %C)) ) {
     printf( "%s=\"%s\"\n", $_, $C{$_});
   }
+  foreach ( sort( keys( %SBL)) ) {
+    printf( "SBL: %s=\"%s\"\n", $_, $SBL{$_});
+  }
 }
 
 open( IN, "< $in") ||